Cybersecurity glossary
What is FREAK (CVE-2015-0204)?
Learn what the FREAK attack (CVE-2015-0204) is, how TLS export-grade RSA cipher suites enabled man-in-the-middle downgrades, who was affected, and how modern TLS configurations eliminate the risk.
Definition
FREAK (Factoring RSA Export Keys), tracked as CVE-2015-0204, is a TLS vulnerability class in which a man-in-the-middle can downgrade a connection to export-grade RSA cipher suites with weak keys that can be factored, allowing decryption of supposedly secure sessions.
Why FREAK mattered
In 2015, researchers showed that many TLS clients and servers still supported export-grade RSA cipher suites—cryptography weakened decades earlier for regulatory reasons. FREAK (Factoring RSA Export Keys), associated with CVE-2015-0204, demonstrated that a man-in-the-middle could force those suites and then factor the weak RSA keys to decrypt traffic.
The lesson was blunt: obsolete compatibility options are attack surface. “We support every cipher for old clients” became “we offer attackers a downgrade ramp.”
How the FREAK attack works
Position as MITM
The attacker intercepts the TLS handshake between client and server.
Rewrite cipher negotiation
Messages are manipulated so the connection selects an export-grade RSA suite.
Server uses a weak RSA key
Export suites historically used 512-bit RSA material that is factorable with modest resources.
Attacker factors the key
Once factored, the attacker can decrypt premaster secret material for that session design.
Session confidentiality breaks
HTTPS content, cookies, and credentials can be recovered from the captured session.
Patch and disable exports
Vendors fixed acceptance bugs; operators removed export suites from configurations.
Who was affected
Vulnerable clients
Browsers and TLS libraries that would accept export-grade RSA when a MITM offered them.
Permissive servers
TLS terminators that still enabled EXPORT cipher suites for compatibility.
High-value HTTPS sites
Any service where session decryption yielded credentials or personal data.
Enterprise middleboxes
Appliances with aging TLS stacks that lagged behind browser patch cycles.
FREAK compared with related TLS failures
| Property | FREAK | Logjam | BEAST |
|---|---|---|---|
| CVE focus | CVE-2015-0204 family | CVE-2015-4000 | CVE-2011-3389 |
| Weakness | Export-grade RSA | Export-grade Diffie-Hellman | TLS 1.0 CBC IV predictability |
| Primary fix | Disable export RSA suites; patch clients | Disable export DH; use strong parameters | Upgrade TLS; avoid vulnerable CBC paths |
Mitigation checklist
- Disable all EXPORT cipher suites on every TLS terminator and client library you control.
- Patch OpenSSL and other TLS stacks to versions that reject FREAK-class negotiation bugs.
- Prefer TLS 1.2 and TLS 1.3 with modern cipher allowlists aligned to NIST guidance.
- Scan public and internal endpoints for export suites after configuration changes.
- Remove 'maximum compatibility' templates that reintroduce obsolete cryptography.
- Monitor for protocol downgrade patterns in TLS telemetry where available.
- Treat middleboxes and legacy appliances as first-class TLS inventory, not exceptions forever.
- Document approved cipher suites so teams do not re-enable weak options during incidents.
The practical takeaway
FREAK (CVE-2015-0204) showed that export-grade RSA cipher suites could be forced by a MITM and then broken, defeating TLS confidentiality. The durable fix is simple in principle: never offer or accept export cryptography, keep TLS libraries patched, and run modern protocol baselines.
If your scanners still find EXPORT in a cipher list, treat it as an active historical vulnerability—not a nostalgic compatibility footnote.
Related security terms
SSL/TLS
The protocols whose cipher suite negotiation FREAK abused through export-grade options.
Logjam (CVE-2015-4000)
A related export-grade attack targeting Diffie-Hellman instead of RSA.
Man-in-the-Middle (MITM)
Network position required to force the FREAK downgrade.
HTTPS
The common deployment of TLS where FREAK threatened session confidentiality.
Frequently asked questions
What is the FREAK attack in simple terms?
FREAK tricks a client and server into using an old 'export-grade' RSA cipher with a weak key. An attacker in the middle can factor that key and decrypt the TLS session.
What does CVE-2015-0204 refer to?
CVE-2015-0204 identifies the FREAK-related vulnerability in OpenSSL and related stacks that could accept export-grade RSA suites and enable the downgrade attack.
Why did export-grade ciphers exist?
Historical US export regulations once limited cryptographic strength in software shipped internationally. Remnants of those weak suites remained in TLS implementations long after the policy context changed.
Does FREAK still affect modern systems?
Systems that disable export cipher suites and run patched TLS libraries are not vulnerable to classic FREAK. Legacy appliances that still offer export suites remain a concern.
How is FREAK different from Logjam?
FREAK targets export-grade RSA key exchange. Logjam targets export-grade Diffie-Hellman parameters. Both are MITM downgrade families rooted in obsolete export cryptography.
How do you mitigate FREAK?
Patch TLS libraries, disable export cipher suites on servers and clients, prefer modern TLS versions, and verify configurations with scanners.
What should operators check today?
Confirm no EXPORT cipher suites are enabled on public and internal TLS terminators, and that clients cannot be coerced into negotiating them.
References
Explore authoritative guidance and frameworks related to freak (cve-2015-0204).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.